Re: [dnsext] afasterinternet.com trial and draft-vandergaast-edns-client-subnet-00

[Wilmer van der Gaast <[e-mail]>]

On 1 September 2011 08:24, Marc Lampo <[e-mail]> wrote:
> [...]
>
> For an authoritative name server, implementing DNSSEC and this RFC,
> it probably implies that it must be able to calculate RRSIG's "on the
> fly";
> Which implies that it must have access to the private part of DNSKEY's;
> Which implies that signing on a hidden master
> and distributing signed data to public slaves is not enough.

As someone else already pointed out, this is not strictly necessary.
Also, this is not specific to edns-client-subnet as there are
nameservers right now that use the query source IP to determine the
optimal response.

>From how I parse the DNSSEC specs, the OPT record is not signed
(wouldn't be possible without secret keys on the server anyway), so
edns-client-subnet doesn't change the situation.

It may still be reasonable to mention something along these lines in the I-D.

I assume the attack scenario you're talking about is sending queries
with many different source IP addresses/client-subnet options and
sending spoofed responses with no client-subnet option at all?


Regards,

-- 
Wilmer van der Gaast, Traffic SRE/Google Public DNS team.
Google Ireland.